Skip to content
Fencer Intel
medium 4.3

CVE-2020-2306 json

Missing Authorization in Jenkins Mercurial Plugin

published 6y ago modified 4mo ago also GHSA-vrrc-3wwh-frgx , EUVD-2022-5423

cvss
4.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.

Patch / fix

  • maven org.jenkins-ci.plugins:mercurial 2.8.1, 2.9.1, 2.10.1, 2.12
  • Jenkins project Jenkins Mercurial Plugin 2.8.1, 2.9.1, 2.10.1
  • python-urllib3 openshift 4.5 1.26.2-1.el7
  • python2-urllib3 openshift 4.5 1.26.2-1.el7
  • jenkins-2-plugins openshift 4.5 4.5.1610108899-1.el7
  • jenkins openshift 3.11 2.263.3.1612433584-1.el7
  • python-rsa openshift 3.11 4.5-3.el7
  • python2-rsa openshift 3.11 4.5-3.el7
  • jenkins-2-plugins openshift 3.11 3.11.1612862361-1.el7
  • cri-o openshift 4.6 1.19.1-2.rhaos4.6.git2af9ecf.el8

red hat advisories RHSA-2021:0034RHSA-2021:0637RHSA-2021:0038

Is CVE-2020-2306 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-2306 updated cvss 4.3

jenkins-2-plugins/mercurial: Missing permission check in an HTTP endpoint could result in information disclosure

  • Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins 3.11.1612862361-1.el7
    fixed: vendor fix RHSA-2021:0637
  • Red Hat OpenShift Container Platform 4.5 jenkins-2-plugins 4.5.1610108899-1.el7
    fixed: vendor fix RHSA-2021:0034
  • Red Hat OpenShift Container Platform 4.6 jenkins-2-plugins 4.6.1608634578-1.el7, jenkins-2-plugins 4.6.1609853716-1.el8
    fixed: vendor fix RHSA-2021:0038
  • Red Hat OpenShift Container Platform 3.11 haproxy 1.8.28-1.el7, python-rsa 4.5-3.el7, python2-rsa 4.5-3.el7, haproxy18 1.8.28-1.el7, jenkins 2.263.3.1612433584-1.el7, prometheus 3.11.394-1.git.5026.2c9627f.el7, +39 more Red Hat OpenShift Container Platform 4.5 python-urllib3 1.26.2-1.el7, python2-urllib3 1.26.2-1.el7, cri-o 1.18.4-5.rhaos4.5.gitd655863.el7, cri-o 1.18.4-5.rhaos4.5.gitd655863.el8, openshift 4.5.0-202012221738.p0.git.0.9c544e4.el7, openshift 4.5.0-202012221738.p0.git.0.9c544e4.el8, +8 more Red Hat OpenShift Container Platform 4.6 cri-o 1.19.1-2.rhaos4.6.git2af9ecf.el8, console-login-helper-messages 0.20.3-1.rhaos4.6.el8, openshift 4.6.0-202012190744.p0.git.94235.c62c6f7.el7, openshift 4.6.0-202012190744.p0.git.94235.c62c6f7.el8, openshift-ansible 4.6.0-202012172338.p0.git.0.a15d08c.el7, openshift-kuryr 4.6.0-202012171504.p0.git.2216.1fecf92.el8, +14 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.10% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.jenkins-ci.plugins:mercurial
>=2.11, <2.12
>=2.10, <2.10.1
>=2.9, <2.9.1
<2.8.1
2.12
2.10.1
2.9.1
2.8.1

Affected products

  • Jenkins project Jenkins Mercurial Plugin

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.